Does ChatGPT train on data employees paste into it?

Your policy applies to the tenant you bought. Your employees’ behaviour applies to whatever they are logged into, and someone with your enterprise seat and a personal free account in the same browser can move between them without noticing.

Nothing in the enterprise agreement reaches the personal session.

Training dominates the conversation because it is vivid. These are less discussed and, for most organisations, larger.

Deleting a conversation removes it from the interface and, after the retention window, from storage. If the content was already used in training, deletion does not extract its influence from the model’s weights, that is not a capability anyone currently offers at production scale.

Which is the real point: the effective control is at submission time. Once sensitive data has been sent to a third party, every remaining option is mitigation of a disclosure that has already occurred.

People reach for the enterprise tier expecting a different, safer system. What they get is the same system with different promises attached, and understanding that is what makes the control decisions obvious.

The model is generally the same model. What changes is a contract: an undertaking not to train on your content, a defined retention period, a named processing region in some cases, an addendum you can show an auditor, and somebody to call. Those are worth real money and they are the entire difference. Nothing about the tier changes what happens if a person types something they should not have typed.

Which is the whole argument for a control at the point of sending. The contract governs what the provider may do with what it receives. It has nothing to say about whether it should have received it, and that is the question your staff are answering several times a day without knowing it.

Provider marketing pages change, and they are not the document anybody will hold a provider to. The commitments that matter are in the data processing addendum and the enterprise terms, and they are worth reading once rather than summarising from a blog post.

Four clauses carry the weight. Whether inputs and outputs are excluded from training, and whether that exclusion is a term or a toggle. The retention period, stated in days rather than described as limited. The subprocessor list, which is who else touches the data and is usually a link rather than a clause. And the processing location, which decides whether a transfer question arises at all.

The clause people miss is the one about changes. A provider that reserves the right to vary terms on notice has given you a commitment with a shelf life, and if nobody owns re-reading it at renewal, the assessment you did is describing terms that no longer apply. Put a date on it in the same place you record the contract.

Once the enterprise tenant is in place with training excluded, the temptation is to tell staff the problem is solved. It is a reasonable thing to want and it produces the specific failure this page exists to describe.

The tenant is covered. The person signed into their own account on the same website, on the same laptop, in a different browser profile, is not, and nothing about the interface tells them which one they are in. Nor is the colleague who found a newer tool last week that does one job better. The message that works is narrower and more honest: this tool, signed in this way, is covered by an agreement; anything else is not, and here is how to ask for something else to be added.

That message is only credible if the sanctioned tool is genuinely good enough for the work. The most effective control in this whole category is a well-chosen approved tool that people prefer, and no detection product, including ours, substitutes for it.